rigless 0.0.2

// Copyright (c) 2026 Rigless Labs.
// SPDX-License-Identifier: Apache-2.0
//! The general-purpose timer of RM0090 rev 22 chapter 18, written against the `tim2` layout, so `build` binds it to
//! TIM2; TIM3 to TIM5 have their own layouts, TIM3 and TIM4 with a 16-bit counter, and bind when the counter width
//! becomes a parameter.
//!
//! Every functional section 18.3.1 to 18.3.16 and every register 18.4.1 to 18.4.19 is implemented. The counter
//! lives on counter-clock cycles: while the internal clock drives it a cycle has an instant on the virtual clock
//! and the model asks to be woken at the next one that matters; while an external clock drives it a cycle is an
//! edge arriving through an input method. Every entry point first settles the timer up to `now`, so the event
//! queue is only a wake-up and the arithmetic is the same whichever clock counts. Nothing here is register-only.
//!
//! | Register or section | Behaviour | Source | Test |
//! |---|---|---|---|
//! | Time-base unit | `PSC + 1` input cycles per count, the prescaler buffered until the update, `ARR` preloaded under `ARPE`, the update at overflow or underflow | 18.3.1, 18.4.10 to 18.4.12 | `the_update_comes_every_period_without_drift`, `arr_preload_and_the_prescaler_take_effect_at_the_update` |
//! | Counter modes | Up, down, and the three centre-aligned modes with `DIR` set by hardware and the flags gated by `CMS`; a match at the crest counts as up and one at the valley as down, and a value above `ARR` flags at the crest only, figure 165 | 18.3.2, 18.4.1, 18.4.5 | `down_counting_underflows_from_arr_to_zero`, `centre_aligned_counting_turns_at_arr_and_zero`, `centre_aligned_flags_follow_figure_165` |
//! | `UDIS`, `URS`, `UG`, `OPM` | The update disabled keeps the shadows, the request source gates the flag, `UG` reinitialises, one-pulse stops at the update | 18.3.2, 18.4.1, 18.4.6 | `ug_reinitialises_and_sets_uif_unless_urs`, `udis_keeps_the_shadows_but_reinitialises`, `one_pulse_mode_stops_at_the_update` |
//! | Clock selection | Internal clock, external clock mode 1 on the trigger input, external clock mode 2 on `ETR`, the internal triggers | 18.3.3, 18.4.3 | `external_clock_mode_1_counts_the_trigger_edges`, `external_clock_mode_2_counts_etr_edges_through_its_prescaler` |
//! | Capture/compare channels | A preload and a shadow per channel, `CCxS` choosing the direction and the input, `TRC` as the input under an internal trigger, `CCxS` frozen while enabled | 18.3.4, 18.4.7 to 18.4.9, 18.4.13 to 18.4.16 | `ccr_preload_takes_effect_at_the_update`, `an_input_channel_is_read_only`, `a_channel_on_trc_captures_the_internal_trigger` |
//! | Input capture | The filter, the edge polarity, the prescaler, the capture into `CCRx`, `CCxIF` and `CCxOF`, cleared by reading | 18.3.5, 18.4.5 | `a_capture_latches_the_counter_and_flags_it`, `the_input_filter_drops_a_short_pulse`, `the_capture_prescaler_captures_every_nth_edge` |
//! | PWM input | Two channels on one input with opposite polarity and the reset mode | 18.3.6 | `pwm_input_measures_period_and_duty` |
//! | Forced output | `OCxM` 100 and 101 force the reference; the flag still follows the match | 18.3.7 | `forced_output_holds_its_level_and_the_flag_still_matches` |
//! | Output compare | Frozen, active, inactive, and toggle on match; `CCxIF`; polarity and enable; a value above `ARR` flags at the boundary | 18.3.8, 18.4.5, 18.4.9 | `a_compare_match_toggles_the_output_at_its_instant`, `active_and_inactive_on_match_set_the_reference`, `a_compare_value_above_arr_flags_at_the_overflow` |
//! | PWM | Modes 1 and 2, edge-aligned both ways and centre-aligned, 0% and 100%; the reference is the comparison except while `ETRF` holds it | 18.3.9, figure 165 | `pwm_mode_1_is_high_below_ccr`, `pwm_holds_at_zero_and_above_arr`, `pwm_mode_2_down_counting_inverts_the_comparison`, `centre_aligned_pwm_follows_figure_165` |
//! | One-pulse mode | The trigger starts the counter, the pulse spans `CCR` to `ARR`, `OCxFE` acts on the trigger | 18.3.10 | `one_pulse_mode_stops_at_the_update`, `fast_enable_acts_on_the_trigger` |
//! | `OCxREF` clear | A rising `ETRF` clears the reference until the next update under `OCxCE`; a level still high at the update does not clear it again, figure 167 | 18.3.11 | `etrf_clears_the_reference_until_the_update`, `an_etrf_clear_holds_through_a_comparison_that_flips` |
//! | Encoder interface | Modes 1 to 3 counting on one or both inputs with the direction from the other, table 97; `DIR` follows every transition, counted or not; mode 1 counts `TI1FP1` and mode 2 `TI2FP2` as 18.4.3 says, where 18.3.12's first paragraph has the two swapped | 18.3.12, 18.4.3 | `encoder_mode_counts_with_the_phase`, `encoder_modes_1_and_2_count_one_input_and_steer_on_both` |
//! | XOR input | `TI1S` feeds channel 1 with `CH1 ^ CH2 ^ CH3` | 18.3.13, 18.4.2 | `ti1s_xors_the_three_inputs` |
//! | Slave modes | Reset, gated, and trigger on the selected trigger input, `TIF`; both edges under `CCxNP`; the external clock once when modes 1 and 2 both name `ETRF` | 18.3.14, 18.4.3, 18.4.9 | `reset_mode_reinitialises_on_the_trigger`, `gated_mode_counts_while_the_trigger_is_high`, `trigger_mode_starts_on_the_edge`, `trigger_mode_takes_both_edges_under_ccnp`, `etrf_as_both_external_clocks_counts_once` |
//! | Master mode | `TRGO` from reset, `UG` or the slave reset, enable, update, the compare pulse, or a reference | 18.3.15, 18.4.2 | `trgo_follows_the_master_mode`, `trgo_pulses_on_the_compare_and_the_slave_reset` |
//! | Debug mode | The counter holds while the core is halted and the debug module says so | 18.3.16 | `the_counter_holds_while_halted` |
//! | `DIER`, `SR` | One interrupt level: any flag set with its enable set | 18.4.4, 18.4.5 | `the_interrupt_is_the_level_of_flag_and_enable` |
//! | DMA requests | Update, capture/compare, and trigger requests, `CCDS`, the burst through `DCR` and `DMAR` under the target's write rules | 18.4.4, 18.4.17, 18.4.18 | `dma_requests_are_counted_and_the_burst_walks_the_registers`, `the_trigger_request_and_the_burst_into_sr` |
//! | `TIM2_OR` | `ITR1_RMP` held for the board, whose mux puts `TIM8_TRGO`, the PTP, OTG FS, or OTG HS source on `ITR1`; the timer counts whichever arrives | 18.4.19 | `itr1_remap_moves_the_internal_trigger` |
//! | `CNT`, reset state | A write starts the count there; `ARR` is all ones at reset | 18.4.10, 18.4.12 | `a_write_to_cnt_sets_the_count` |
//! | `MSM` | The trigger's resynchronisation delay for slaves | 18.4.3 | not modeled, the delay note below |
//! | Access widths | A 32-bit register written by words, the rest by half-words or words | 18.4 | not modeled: the manual names the widths a write must use and not the effect of a narrower one, so a narrower write lands in its lane |
//! | ES0206 rev 24, 2.7.3 | A second match on the next counter cycle after a `CCR` change, in the three patterns: a toggle output does not toggle again, and centre-aligned the flag does not rise; other modes are unaffected | modeled | `erratum_2_7_3_misses_the_consecutive_match`, `erratum_2_7_3_at_the_valley_and_in_other_modes` |
//! | ES0206 rev 24, 2.7.4 | In reset mode a reference cleared by `ETRF` stays inactive one extra cycle when the reset precedes the compare | modeled | `erratum_2_7_4_holds_the_cleared_reference_one_extra_cycle` |
//! | ES0206 rev 24, 2.7.2 | A trigger pulse is lost when the slave's clock is not yet enabled | pending, the RCC of 0.2, RL-8 | |
//! | ES0206 rev 24, 2.7.1 | The break input and `BDTR` | not applicable, TIM2 to TIM5 have no break input | |
//! | ES0206 rev 24, 2.2.7 | A register write within the clock-enable delay is lost | pending, the RCC of 0.2, RL-8 | |
//!
//! Where the manual gives a resynchronisation delay of a cycle or two for an external edge, `MSM` included, the
//! model applies the edge on the cycle it arrives in. The input filter validates a transition after its `N` samples and drops a
//! transition the input reverts before then; the sampling phase within a cycle is not modeled. Both are said here
//! and nowhere else.

use std::num::NonZeroU64;

use crate::device::{Device, DeviceContext, Level, RegisterFile};
use crate::soc::FieldSpec;
use crate::time::{EventId, VirtualNanos};

use crate::soc::stm32f427::generated::tim2::{
    Register, ccer, ccmr1_input, ccmr1_output, ccmr2_input, ccmr2_output, cr1, cr2, dcr, dier, egr,
    smcr, sr,
};

const NANOS_PER_SECOND: u128 = 1_000_000_000;
const CHANNEL_COUNT: u8 = 4;
const CHANNELS: usize = CHANNEL_COUNT as usize;
// The interrupt the instance lists first, its global interrupt, RM0090 rev 22 table 63.
const GLOBAL_INTERRUPT: usize = 0;
const COUNTER_MASK: u64 = u32::MAX as u64;
const HALF_WORD: u64 = 0xFFFF;

// CR1, 18.4.1.
const CMS_EDGE_ALIGNED: u64 = 0b00;
const CMS_FLAGS_DOWN: u64 = 0b01;
const CMS_FLAGS_UP: u64 = 0b10;
// CR2, 18.4.2.
const MMS_RESET: u64 = 0b000;
const MMS_ENABLE: u64 = 0b001;
const MMS_UPDATE: u64 = 0b010;
const MMS_COMPARE_PULSE: u64 = 0b011;
const MMS_FIRST_REFERENCE: u64 = 0b100;
// SMCR, 18.4.3.
const SMS_ENCODER_1: u64 = 0b001;
const SMS_ENCODER_2: u64 = 0b010;
const SMS_ENCODER_3: u64 = 0b011;
const SMS_RESET: u64 = 0b100;
const SMS_GATED: u64 = 0b101;
const SMS_TRIGGER: u64 = 0b110;
const SMS_EXTERNAL_CLOCK_1: u64 = 0b111;
const TS_LAST_INTERNAL: u64 = 0b011;
const TS_TI1_EDGES: u64 = 0b100;
const TS_TI1FP1: u64 = 0b101;
const TS_TI2FP2: u64 = 0b110;
const TS_ETRF: u64 = 0b111;
// CCMRx, 18.4.7 and 18.4.8, per channel: the input and output views of a pair's register share its storage.
const CC_S: [&FieldSpec; CHANNELS] = [
    ccmr1_output::CC1S,
    ccmr1_output::CC2S,
    ccmr2_output::CC3S,
    ccmr2_output::CC4S,
];
const IC_PSC: [&FieldSpec; CHANNELS] = [
    ccmr1_input::ICPCS,
    ccmr1_input::IC2PCS,
    ccmr2_input::IC3PSC,
    ccmr2_input::IC4PSC,
];
const IC_F: [&FieldSpec; CHANNELS] = [
    ccmr1_input::IC1F,
    ccmr1_input::IC2F,
    ccmr2_input::IC3F,
    ccmr2_input::IC4F,
];
const OC_FE: [&FieldSpec; CHANNELS] = [
    ccmr1_output::OC1FE,
    ccmr1_output::OC2FE,
    ccmr2_output::OC3FE,
    ccmr2_output::OC4FE,
];
const OC_PE: [&FieldSpec; CHANNELS] = [
    ccmr1_output::OC1PE,
    ccmr1_output::OC2PE,
    ccmr2_output::OC3PE,
    ccmr2_output::OC4PE,
];
const OC_M: [&FieldSpec; CHANNELS] = [
    ccmr1_output::OC1M,
    ccmr1_output::OC2M,
    ccmr2_output::OC3M,
    ccmr2_output::OC4M,
];
const OC_CE: [&FieldSpec; CHANNELS] = [
    ccmr1_output::OC1CE,
    ccmr1_output::OC2CE,
    ccmr2_output::OC3CE,
    ccmr2_output::OC4CE,
];
const CCS_OUTPUT: u64 = 0b00;
const CCS_OWN_INPUT: u64 = 0b01;
const CCS_OTHER_INPUT: u64 = 0b10;
const CCS_TRC: u64 = 0b11;
const OCM_ACTIVE_ON_MATCH: u64 = 0b001;
const OCM_INACTIVE_ON_MATCH: u64 = 0b010;
const OCM_TOGGLE: u64 = 0b011;
const OCM_FORCE_INACTIVE: u64 = 0b100;
const OCM_FORCE_ACTIVE: u64 = 0b101;
const OCM_PWM_1: u64 = 0b110;
const OCM_PWM_2: u64 = 0b111;
// CCER, 18.4.9, per channel.
const CC_E: [&FieldSpec; CHANNELS] = [ccer::CC1E, ccer::CC2E, ccer::CC3E, ccer::CC4E];
const CC_P: [&FieldSpec; CHANNELS] = [ccer::CC1P, ccer::CC2P, ccer::CC3P, ccer::CC4P];
const CC_NP: [&FieldSpec; CHANNELS] = [ccer::CC1NP, ccer::CC2NP, ccer::CC3NP, ccer::CC4NP];
// SR, 18.4.5, per channel.
const CC_IF: [&FieldSpec; CHANNELS] = [sr::CC1IF, sr::CC2IF, sr::CC3IF, sr::CC4IF];
const CC_OF: [&FieldSpec; CHANNELS] = [sr::CC1OF, sr::CC2OF, sr::CC3OF, sr::CC4OF];
// DIER, 18.4.4, per channel.
const CC_DE: [&FieldSpec; CHANNELS] = [dier::CC1DE, dier::CC2DE, dier::CC3DE, dier::CC4DE];
// Each flag of `SR` with the enable of `DIER` that lets it raise the interrupt, 18.4.4 and 18.4.5.
const INTERRUPTS: [(&FieldSpec, &FieldSpec); 6] = [
    (sr::UIF, dier::UIE),
    (sr::CC1IF, dier::CC1IE),
    (sr::CC2IF, dier::CC2IE),
    (sr::CC3IF, dier::CC3IE),
    (sr::CC4IF, dier::CC4IE),
    (sr::TIF, dier::TIE),
];
// EGR, 18.4.6, per channel.
const CC_G: [&FieldSpec; CHANNELS] = [egr::CC1G, egr::CC2G, egr::CC3G, egr::CC4G];
// The registers a DMA burst reaches, `DBA` counted in words from `CR1`, 18.4.17; the gaps are reserved.
const BURST_REGISTERS: [Option<Register>; 20] = [
    Some(Register::Cr1),
    Some(Register::Cr2),
    Some(Register::Smcr),
    Some(Register::Dier),
    Some(Register::Sr),
    Some(Register::Egr),
    Some(Register::Ccmr1Input),
    Some(Register::Ccmr2Input),
    Some(Register::Ccer),
    Some(Register::Cnt),
    Some(Register::Psc),
    Some(Register::Arr),
    None,
    Some(Register::Ccr1),
    Some(Register::Ccr2),
    Some(Register::Ccr3),
    Some(Register::Ccr4),
    None,
    Some(Register::Dcr),
    Some(Register::Dmar),
];
// The digital filter rows of 18.4.3 and 18.4.7: the sampling clock and the consecutive samples a transition needs.
const FILTERS: [(Sampling, u128); 16] = [
    (Sampling::Dts(1), 0),
    (Sampling::Internal, 2),
    (Sampling::Internal, 4),
    (Sampling::Internal, 8),
    (Sampling::Dts(2), 6),
    (Sampling::Dts(2), 8),
    (Sampling::Dts(4), 6),
    (Sampling::Dts(4), 8),
    (Sampling::Dts(8), 6),
    (Sampling::Dts(8), 8),
    (Sampling::Dts(16), 5),
    (Sampling::Dts(16), 6),
    (Sampling::Dts(16), 8),
    (Sampling::Dts(32), 5),
    (Sampling::Dts(32), 6),
    (Sampling::Dts(32), 8),
];
#[derive(Debug, Clone, Copy)]
enum Sampling {
    // `fCK_INT`.
    Internal,
    // `fDTS` over the divisor, `fDTS` being `CK_INT` over the `CKD` division of 18.4.1.
    Dts(u128),
}

/// A capture/compare channel, 1 to 4.
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, PartialOrd, Ord)]
pub struct Channel(u8);

impl Channel {
    /// Channel `number`, 1 to 4.
    #[must_use]
    pub const fn new(number: u8) -> Option<Self> {
        if number >= 1 && number <= CHANNEL_COUNT {
            Some(Self(number - 1))
        } else {
            None
        }
    }

    const fn index(self) -> usize {
        self.0 as usize
    }

    fn all() -> impl Iterator<Item = Self> {
        (0..CHANNEL_COUNT).map(Self)
    }

    // The other channel of the pair sharing a `CCMR` register and each other's input, 1 with 2 and 3 with 4.
    const fn partner(self) -> Self {
        Self(self.0 ^ 1)
    }

    const fn ccr(self) -> Register {
        [
            Register::Ccr1,
            Register::Ccr2,
            Register::Ccr3,
            Register::Ccr4,
        ][self.index()]
    }

    const fn ccmr(self) -> Register {
        if self.0 < 2 {
            Register::Ccmr1Input
        } else {
            Register::Ccmr2Input
        }
    }
}

// The counting direction, `DIR` of 18.4.1.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum Direction {
    Up,
    Down,
}

// Why an update event happened, which decides the flag under `URS` and the counter's reinitialisation.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum UpdateSource {
    Overflow,
    Underflow,
    Software,
    Trigger,
}

// One input stage, 18.3.4: the level on the pin, the level after the filter, and a transition the filter is
// still validating with the clock cycle at which it passes.
#[derive(Debug, Clone, Copy, Default)]
struct Input {
    level: Level,
    filtered: Level,
    pending: Option<(u128, Level)>,
}

// A capture/compare channel's state beyond its registers.
#[derive(Debug, Clone, Copy, Default)]
struct ChannelState {
    // The active capture/compare value, the shadow of 18.3.4.
    shadow: u64,
    // `OCxREF`, active high, 18.3.8.
    reference: bool,
    // How many updates must pass before an `ETRF` clear lifts, 18.3.11 and erratum 2.7.4.
    cleared_for_updates: u8,
    // Whether a compare event has happened since the `ETRF` clear, erratum 2.7.4.
    matched_since_clear: bool,
    // Edges the capture prescaler has seen since the last capture, 18.4.7.
    prescaled_edges: u64,
    // The counter cycle and the value of the last compare match, for erratum 2.7.3 and for not matching twice.
    last_match: Option<(u128, u64)>,
    // `CCxS` as last accepted, held while the channel is enabled, 18.4.7.
    selection: u64,
}

/// DMA requests sent so far, by source, 18.4.4; the DMA model of 0.2 consumes them.
#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
pub struct DmaRequests {
    /// `UDE`.
    pub update: u64,
    /// `CCxDE`, channels 1 to 4.
    pub channels: [u64; CHANNELS],
    /// `TDE`.
    pub trigger: u64,
}

/// The general-purpose timer.
#[derive(Debug)]
pub struct Tim {
    clock_hz: NonZeroU64,
    // Whether the counter is clocked from an input rather than `CK_INT`, 18.3.3.
    external: bool,
    // `CNT_EN`: `CEN`, the gate of gated mode, and the debug halt together, 18.3.1.
    counting: bool,
    // Clock cycles spent not counting, so the counter's cycle count continues where it stopped.
    paused: u128,
    // The clock cycle counting stopped at, valid while stopped.
    stopped_at: u128,
    // Cycles an external clock has delivered, edge by edge.
    external_cycles: u128,
    // The active prescaler and auto-reload, 18.3.1.
    psc: u64,
    arr: u64,
    // The counter's course: the cycle a segment began at, the counter then, and the direction.
    segment_cycle: u128,
    segment_count: u64,
    direction: Direction,
    channels: [ChannelState; CHANNELS],
    inputs: [Input; CHANNELS],
    // The `ETR` pin, `ETR` after `ETP` with its rising edges counted, and `ETRP` after the `ETPS` divider on its
    // way through the filter to `ETRF`, 18.3.3.
    etr_pin: Level,
    etr_polarised: Level,
    etr_edges: u64,
    etr: Input,
    // The trigger input's level, for gated mode, 18.3.14.
    trigger: Level,
    // `TRGO` and the pulses sent on it, 18.3.15.
    trigger_output: Level,
    trigger_pulses: u64,
    dma_requests: DmaRequests,
    burst_index: u64,
    halted: bool,
    // The level last put on the interrupt line, so it moves only when it changes.
    interrupt: Level,
    // The wake-up asked of the queue, its instant and id; any other event id is stale.
    wakeup: Option<(VirtualNanos, EventId)>,
}

impl Tim {
    /// A timer whose `CK_INT` runs at `clock_hz`, the value the board's clock tree feeds it, 18.3.3.
    #[must_use]
    pub fn with_clock(clock_hz: NonZeroU64) -> Self {
        Self {
            clock_hz,
            external: false,
            counting: false,
            paused: 0,
            stopped_at: 0,
            external_cycles: 0,
            psc: 0,
            arr: COUNTER_MASK,
            segment_cycle: 0,
            segment_count: 0,
            direction: Direction::Up,
            channels: [ChannelState::default(); CHANNELS],
            inputs: [Input::default(); CHANNELS],
            etr_pin: Level::Low,
            etr_polarised: Level::Low,
            etr_edges: 0,
            etr: Input::default(),
            trigger: Level::Low,
            trigger_output: Level::Low,
            trigger_pulses: 0,
            dma_requests: DmaRequests::default(),
            burst_index: 0,
            halted: false,
            interrupt: Level::Low,
            wakeup: None,
        }
    }

    /// The level on the `TIMx_CHx` pin of `channel`, through its alternate function.
    pub fn drive_input(
        &mut self,
        channel: Channel,
        level: Level,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        self.settle(registers, context);
        self.inputs[channel.index()].level = level;
        self.refilter(channel, registers, context);
        if channel.index() < 3 && cr2::TI1S.is_set(registers.get(Register::Cr2)) {
            self.refilter(Channel(0), registers, context);
        }
        // A filter with no delay passes now, before anything else sees the input.
        self.settle(registers, context);
        self.finish(registers, context);
    }

    /// The level on the `TIMx_ETR` pin.
    pub fn drive_etr(
        &mut self,
        level: Level,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        self.settle(registers, context);
        self.etr_pin = level;
        self.feed_etr(registers, context);
        self.settle(registers, context);
        self.finish(registers, context);
    }

    // `ETR` through its path of 18.3.3: `ETP`, then the `ETPS` divider making `ETRP`, then the filter to `ETRF`.
    fn feed_etr(&mut self, registers: &RegisterFile, context: &DeviceContext<'_>) {
        let smcr_value = registers.get(Register::Smcr);
        let polarised = if smcr::ETP.is_set(smcr_value) {
            !self.etr_pin
        } else {
            self.etr_pin
        };
        if polarised != self.etr_polarised {
            self.etr_polarised = polarised;
            let every = 1u64 << smcr::ETPS.get(smcr_value);
            self.etr.level = match polarised {
                Level::High => {
                    self.etr_edges += 1;
                    if self.etr_edges.is_multiple_of(every) {
                        Level::High
                    } else {
                        self.etr.level
                    }
                }
                Level::Low => Level::Low,
            };
        }
        let clock = self.clock_cycle(context.now());
        let filter = filter_delay(smcr::ETF.get(smcr_value), registers);
        let prescaled = self.etr.level;
        start_filter(&mut self.etr, prescaled, clock, filter);
    }

    /// The level of internal trigger `ITRx`, 0 to 3, another timer's `TRGO`, table 98; a rise is its edge.
    pub fn drive_internal_trigger(
        &mut self,
        trigger: u8,
        level: Level,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        self.settle(registers, context);
        if smcr::TS.get(registers.get(Register::Smcr)) == u64::from(trigger) {
            if level == Level::High {
                self.trigger_edge(registers, context);
            }
            self.trigger = level;
            self.gate(registers, context);
        }
        self.finish(registers, context);
    }

    /// Whether the core is halted with the debug module set to stop this timer, 18.3.16.
    pub fn halt(
        &mut self,
        halted: bool,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        self.settle(registers, context);
        self.halted = halted;
        self.finish(registers, context);
    }

    /// The `OCx` output of `channel`: its reference through its polarity when enabled, table 99, or `None` while
    /// the output is disabled and the pin is not driven.
    #[must_use]
    pub fn output(&self, channel: Channel, registers: &RegisterFile) -> Option<Level> {
        ccer_field(channel, &CC_E, registers).then(|| {
            let active_low = ccer_field(channel, &CC_P, registers);
            Level::from(self.channels[channel.index()].reference != active_low)
        })
    }

    // The counter's value at `now`, what `CNT` reads.
    fn counter(&self, now: VirtualNanos) -> u64 {
        self.count_at(self.counter_cycle(now))
    }

    /// `TRGO`: its level for the level modes of `MMS`, and the pulses sent so far for the pulse modes, 18.4.2.
    #[must_use]
    pub fn trigger_output(&self) -> (Level, u64) {
        (self.trigger_output, self.trigger_pulses)
    }

    /// DMA requests sent so far.
    #[must_use]
    pub fn dma_requests(&self) -> DmaRequests {
        self.dma_requests
    }

    // `CK_INT` cycles since the virtual clock's zero.
    fn clock_cycle(&self, now: VirtualNanos) -> u128 {
        u128::from(now.0) * u128::from(self.clock_hz.get()) / NANOS_PER_SECOND
    }

    // The first instant at or after `CK_INT` cycle `cycle`.
    fn instant_of_clock_cycle(&self, cycle: u128) -> VirtualNanos {
        let nanos = (cycle * NANOS_PER_SECOND).div_ceil(u128::from(self.clock_hz.get()));
        VirtualNanos(u64::try_from(nanos).expect("the virtual clock outlasts any run"))
    }

    // The counter clock's cycle at `now`: `CK_INT` cycles less the paused ones, frozen while stopped, or the
    // edges an external clock delivered.
    fn counter_cycle(&self, now: VirtualNanos) -> u128 {
        if self.external {
            self.external_cycles
        } else if self.counting {
            self.clock_cycle(now) - self.paused
        } else {
            self.stopped_at - self.paused
        }
    }

    fn instant_of_counter_cycle(&self, cycle: u128) -> VirtualNanos {
        self.instant_of_clock_cycle(cycle + self.paused)
    }

    fn ticks_since_segment(&self, cycle: u128) -> u64 {
        let elapsed = cycle.saturating_sub(self.segment_cycle);
        u64::try_from(elapsed / (u128::from(self.psc) + 1)).expect("ticks fit the counter's course")
    }

    fn count_at(&self, cycle: u128) -> u64 {
        let ticks = self.ticks_since_segment(cycle);
        match self.direction {
            Direction::Up => self.segment_count.wrapping_add(ticks) & COUNTER_MASK,
            Direction::Down => self.segment_count.wrapping_sub(ticks) & COUNTER_MASK,
        }
    }

    fn cycle_of_tick(&self, tick: u64) -> u128 {
        self.segment_cycle + u128::from(tick) * (u128::from(self.psc) + 1)
    }

    fn centre_aligned(registers: &RegisterFile) -> bool {
        cr1::CMS.get(registers.get(Register::Cr1)) != CMS_EDGE_ALIGNED
    }

    // The tick at which the segment ends in an overflow or underflow, 18.3.2, or `None` while `ARR` is zero and
    // the counter is blocked, 18.4.12.
    fn boundary_tick(&self, registers: &RegisterFile) -> Option<(u64, UpdateSource)> {
        if self.arr == 0 {
            return None;
        }
        let centre = Self::centre_aligned(registers);
        Some(match self.direction {
            Direction::Up if centre => (
                self.arr - self.segment_count.min(self.arr),
                UpdateSource::Overflow,
            ),
            Direction::Up if self.segment_count <= self.arr => {
                (self.arr - self.segment_count + 1, UpdateSource::Overflow)
            }
            Direction::Up => (
                COUNTER_MASK - self.segment_count + 1,
                UpdateSource::Overflow,
            ),
            Direction::Down if centre => (self.segment_count, UpdateSource::Underflow),
            Direction::Down => (self.segment_count + 1, UpdateSource::Underflow),
        })
    }

    // The next compare match of an output channel within the segment, as a tick and the value matched.
    fn match_tick(&self, channel: Channel, registers: &RegisterFile) -> Option<(u64, u64)> {
        if channel_selection(channel, registers) != CCS_OUTPUT {
            return None;
        }
        let value = self.channels[channel.index()].shadow;
        let tick = match self.direction {
            Direction::Up => value.checked_sub(self.segment_count)?,
            Direction::Down => self.segment_count.checked_sub(value)?,
        };
        if tick == 0 {
            // A match at a segment's first tick is the segment start's, `matches_at_segment_start`.
            return None;
        }
        let cycle = self.cycle_of_tick(tick);
        match self.channels[channel.index()].last_match {
            Some((last, _)) if cycle <= last => None,
            _ => Some((tick, value)),
        }
    }

    // Applies every counter event up to and including `cycle`, in order.
    fn advance_counter_to(
        &mut self,
        cycle: u128,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        while let Some((event_cycle, event)) = self.next_counter_event(registers) {
            if event_cycle > cycle {
                break;
            }
            match event {
                CounterEvent::Boundary(source) => {
                    self.boundary(event_cycle, source, registers, context);
                }
                CounterEvent::Match(found) => {
                    self.compare_match(found, Some(self.direction), registers);
                }
            }
        }
    }

    fn next_counter_event(&self, registers: &RegisterFile) -> Option<(u128, CounterEvent)> {
        if !self.counting {
            return None;
        }
        let boundary = self
            .boundary_tick(registers)
            .map(|(tick, source)| (self.cycle_of_tick(tick), CounterEvent::Boundary(source)));
        let matches = Channel::all().filter_map(|channel| {
            let (tick, value) = self.match_tick(channel, registers)?;
            let within = boundary
                .is_none_or(|(boundary_cycle, _)| self.cycle_of_tick(tick) < boundary_cycle);
            within.then(|| {
                let cycle = self.cycle_of_tick(tick);
                let found = Match {
                    channel,
                    cycle,
                    value,
                };
                (cycle, CounterEvent::Match(found))
            })
        });
        boundary
            .into_iter()
            .chain(matches)
            .min_by_key(|(cycle, event)| (*cycle, event.order()))
    }

    // The counter overflows or underflows at `cycle`: the update, the new segment, the compare values above
    // `ARR` that flag here, and the matches at the new count, 18.3.2 and 18.4.5.
    fn boundary(
        &mut self,
        cycle: u128,
        source: UpdateSource,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        let centre = Self::centre_aligned(registers);
        let old_arr = self.arr;
        self.update(source, cycle, registers, context);
        if centre {
            self.direction = match source {
                UpdateSource::Overflow => Direction::Down,
                _ => Direction::Up,
            };
            self.segment_count = match self.direction {
                Direction::Down => self.arr,
                Direction::Up => 0,
            };
            set_direction_bit(self.direction, registers);
        } else {
            self.segment_count = match self.direction {
                Direction::Up => 0,
                Direction::Down => self.arr,
            };
        }
        self.segment_cycle = cycle;
        // A value above `ARR` flags at the overflow, or at the underflow only when counting down edge-aligned,
        // 18.4.5 and figure 165.
        if source == UpdateSource::Overflow || !centre {
            for channel in Channel::all() {
                let output = channel_selection(channel, registers) == CCS_OUTPUT;
                if output && self.channels[channel.index()].shadow > old_arr {
                    self.flag_compare(channel, registers);
                }
            }
        }
        self.matches_at_segment_start(None, registers);
    }

    // The counter reaches a compare value: the flag under the centre-aligned gate, the reference by mode, the
    // DMA request, and the compare pulse of `TRGO`, 18.3.8, 18.3.9, 18.4.1.
    fn compare_match(
        &mut self,
        found: Match,
        counted: Option<Direction>,
        registers: &mut RegisterFile,
    ) {
        let Match {
            channel,
            cycle,
            value,
        } = found;
        let missed = self.missed_by_erratum_2_7_3(channel, cycle, value, registers);
        self.channels[channel.index()].last_match = Some((cycle, value));
        let cms = cr1::CMS.get(registers.get(Register::Cr1));
        let gated = matches!(
            (cms, counted),
            (CMS_FLAGS_DOWN, Some(Direction::Up)) | (CMS_FLAGS_UP, Some(Direction::Down))
        );
        let lost = missed && Self::centre_aligned(registers);
        if !gated && !lost {
            self.flag_compare(channel, registers);
        }
        let state = &mut self.channels[channel.index()];
        if !missed {
            state.matched_since_clear = true;
        }
        match output_mode(channel, registers) {
            OCM_ACTIVE_ON_MATCH => state.reference = true,
            OCM_INACTIVE_ON_MATCH => state.reference = false,
            OCM_TOGGLE if !missed => state.reference = !state.reference,
            _ => {}
        }
        self.refresh_pwm(channel, self.count_at(cycle), registers);
    }

    fn flag_compare(&mut self, channel: Channel, registers: &mut RegisterFile) {
        flag(registers, CC_IF[channel.index()]);
        let dier_value = registers.get(Register::Dier);
        let on_update = cr2::CCDS.is_set(registers.get(Register::Cr2));
        if CC_DE[channel.index()].is_set(dier_value) && !on_update {
            self.dma_requests.channels[channel.index()] += 1;
        }
        if channel.index() == 0 && cr2::MMS.get(registers.get(Register::Cr2)) == MMS_COMPARE_PULSE {
            self.trigger_pulses += 1;
        }
    }

    // Erratum ES0206 rev 24, 2.7.3: a match one counter cycle after the previous one, brought by a `CCR` change,
    // is missed when the pair is `ARR` then 0 edge-aligned, `ARR - 1` then `ARR` at the crest, or 1 then 0 at the
    // valley: a toggle output does not toggle, and centre-aligned the flag does not rise.
    fn missed_by_erratum_2_7_3(
        &self,
        channel: Channel,
        cycle: u128,
        value: u64,
        registers: &RegisterFile,
    ) -> bool {
        let Some((last_cycle, last_value)) = self.channels[channel.index()].last_match else {
            return false;
        };
        if cycle != last_cycle + u128::from(self.psc) + 1 || value == last_value {
            return false;
        }
        // The crest and the valley are boundaries, so the direction has already turned; the values say which.
        if Self::centre_aligned(registers) {
            (last_value + 1 == self.arr && value == self.arr) || (last_value == 1 && value == 0)
        } else {
            last_value == self.arr && value == 0
        }
    }

    // The compare values equal to the counter at a segment's first tick match at once.
    // `counted` is the direction the count was reached in, or `None` at the crest and the valley, where the flag
    // rises whatever `CMS` says, figure 165.
    fn matches_at_segment_start(
        &mut self,
        counted: Option<Direction>,
        registers: &mut RegisterFile,
    ) {
        let cycle = self.segment_cycle;
        for channel in Channel::all() {
            if channel_selection(channel, registers) != CCS_OUTPUT {
                continue;
            }
            let value = self.channels[channel.index()].shadow;
            let already = matches!(self.channels[channel.index()].last_match, Some((last, _)) if last >= cycle);
            if value == self.segment_count && !already {
                let found = Match {
                    channel,
                    cycle,
                    value,
                };
                self.compare_match(found, counted, registers);
            }
        }
        for channel in Channel::all() {
            self.refresh_pwm(channel, self.segment_count, registers);
        }
    }

    // The PWM reference is the comparison of 18.3.9, except while an `ETRF` clear holds it low until the update,
    // 18.3.11.
    fn refresh_pwm(&mut self, channel: Channel, count: u64, registers: &RegisterFile) {
        let mode = output_mode(channel, registers);
        let state = &mut self.channels[channel.index()];
        let value = state.shadow;
        let active = match (mode, self.direction) {
            (OCM_PWM_1, Direction::Up) => count < value,
            (OCM_PWM_1, Direction::Down) => count <= value,
            (OCM_PWM_2, Direction::Up) => count >= value,
            (OCM_PWM_2, Direction::Down) => count > value,
            _ => return,
        };
        if state.cleared_for_updates == 0 {
            state.reference = active;
        }
    }

    // An update event from `source`: the shadows reload unless `UDIS`, `UIF` unless `URS` and not a boundary,
    // the counter reinitialises for `UG` and the slave reset, one-pulse mode stops, and the requests go out,
    // 18.3.1, 18.3.2, 18.4.1, 18.4.6.
    fn update(
        &mut self,
        source: UpdateSource,
        cycle: u128,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        let cr1_value = registers.get(Register::Cr1);
        let reinitialise = matches!(source, UpdateSource::Software | UpdateSource::Trigger);
        let centre = Self::centre_aligned(registers);
        if reinitialise {
            self.segment_cycle = cycle;
            self.segment_count = match self.direction {
                Direction::Down if !centre => self.arr,
                _ => 0,
            };
        }
        if cr1::UDIS.is_set(cr1_value) {
            return;
        }
        self.reload_shadows(source, registers);
        if reinitialise && self.direction == Direction::Down && !centre {
            self.segment_count = self.arr;
        }
        let flagged = !cr1::URS.is_set(cr1_value)
            || matches!(source, UpdateSource::Overflow | UpdateSource::Underflow);
        if flagged {
            self.flag_update(registers);
        }
        if cr2::MMS.get(registers.get(Register::Cr2)) == MMS_UPDATE {
            self.trigger_pulses += 1;
        }
        if cr1::OPM.is_set(cr1_value) {
            registers.set(Register::Cr1, cr1::CEN.set(cr1_value, 0));
            self.set_counting(false, context);
        }
    }

    // The update loads the prescaler, the auto-reload, and the preloaded compare values, 18.3.1 and 18.3.4, and
    // counts down the `ETRF` clears, 18.3.11.
    fn reload_shadows(&mut self, source: UpdateSource, registers: &RegisterFile) {
        self.psc = registers.get(Register::Psc) & HALF_WORD;
        self.arr = registers.get(Register::Arr) & COUNTER_MASK;
        for channel in Channel::all() {
            let output = channel_selection(channel, registers) == CCS_OUTPUT;
            if output && ccmr_field(channel, &OC_PE, registers) {
                self.channels[channel.index()].shadow = registers.get(channel.ccr()) & COUNTER_MASK;
            }
            let state = &mut self.channels[channel.index()];
            if state.cleared_for_updates > 0 {
                // Erratum ES0206 rev 24, 2.7.4: a slave reset before the compare leaves the clear one more cycle.
                if source == UpdateSource::Trigger && !state.matched_since_clear {
                    state.cleared_for_updates = 1;
                } else {
                    state.cleared_for_updates -= 1;
                }
            }
        }
    }

    // `UIF` and the DMA requests of an update: `UDE`, and under `CCDS` the channels' too, 18.4.4.
    fn flag_update(&mut self, registers: &mut RegisterFile) {
        flag(registers, sr::UIF);
        let dier_value = registers.get(Register::Dier);
        if dier::UDE.is_set(dier_value) {
            self.dma_requests.update += 1;
        }
        if cr2::CCDS.is_set(registers.get(Register::Cr2)) {
            for channel in Channel::all() {
                if CC_DE[channel.index()].is_set(dier_value) {
                    self.dma_requests.channels[channel.index()] += 1;
                }
            }
        }
    }

    // Starts or stops the counter's clock, keeping the cycle count continuous across the stop.
    fn set_counting(&mut self, counting: bool, context: &mut DeviceContext<'_>) {
        if counting == self.counting {
            return;
        }
        let clock = self.clock_cycle(context.now());
        if counting {
            self.paused += clock - self.stopped_at;
        } else {
            self.stopped_at = clock;
        }
        self.counting = counting;
    }

    // Whether `CNT_EN` should be on: `CEN`, the gate, and the debug halt, 18.3.1 and 18.3.14.
    fn should_count(&self, registers: &RegisterFile) -> bool {
        let cen = cr1::CEN.is_set(registers.get(Register::Cr1));
        let gated = smcr::SMS.get(registers.get(Register::Smcr)) == SMS_GATED;
        cen && !self.halted && (!gated || self.trigger == Level::High)
    }

    // The level channel `channel`'s input stage sees on its pin: the pin, or the XOR of the first three under
    // `TI1S`, 18.3.13.
    fn pin_level(&self, channel: Channel, registers: &RegisterFile) -> Level {
        if channel.index() == 0 && cr2::TI1S.is_set(registers.get(Register::Cr2)) {
            let bits = self.inputs[..3]
                .iter()
                .filter(|input| input.level == Level::High)
                .count();
            Level::from(bits % 2 == 1)
        } else {
            self.inputs[channel.index()].level
        }
    }

    fn refilter(
        &mut self,
        channel: Channel,
        registers: &RegisterFile,
        context: &DeviceContext<'_>,
    ) {
        let level = self.pin_level(channel, registers);
        let clock = self.clock_cycle(context.now());
        let filter = filter_delay(ccmr_value_of(channel, &IC_F, registers), registers);
        start_filter(&mut self.inputs[channel.index()], level, clock, filter);
    }

    // The next filter that passes a transition, as the clock cycle it passes at.
    fn next_filter_event(&self) -> Option<(u128, FilterEvent)> {
        let inputs = self.inputs.iter().enumerate().filter_map(|(index, input)| {
            input
                .pending
                .map(|(cycle, _)| (cycle, FilterEvent::Input(index)))
        });
        let etr = self.etr.pending.map(|(cycle, _)| (cycle, FilterEvent::Etr));
        inputs.chain(etr).min_by_key(|(cycle, _)| *cycle)
    }

    // A filtered input changes level: the captures, the trigger, and the clocks that hang on it, 18.3.4.
    fn filtered_edge(
        &mut self,
        event: FilterEvent,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        match event {
            FilterEvent::Etr => {
                if let Some((_, new)) = self.etr.pending.take() {
                    self.etr.filtered = new;
                    self.etrf_level(new, registers, context);
                }
            }
            FilterEvent::Input(index) => {
                if let Some((_, new)) = self.inputs[index].pending.take() {
                    self.inputs[index].filtered = new;
                    let source = Channel(u8::try_from(index).expect("four channels"));
                    self.input_level(source, new, registers, context);
                }
            }
        }
    }

    // `ETRF` changes level: its rising edge is the external clock of mode 2, the trigger when selected, and the
    // `OCxREF` clear; its level is the trigger's for gated mode, 18.3.3, 18.3.11, 18.3.14.
    fn etrf_level(
        &mut self,
        new: Level,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        let smcr_value = registers.get(Register::Smcr);
        if new == Level::High {
            if smcr::ECE.is_set(smcr_value) {
                self.external_tick(registers, context);
            }
            if smcr::TS.get(smcr_value) == TS_ETRF {
                self.trigger_edge(registers, context);
            }
            self.clear_references(registers);
        }
        if smcr::TS.get(smcr_value) == TS_ETRF {
            self.trigger = new;
            self.gate(registers, context);
        }
    }

    // A filtered channel input changes level: the captures it is mapped to, the trigger, and the encoder, 18.3.4.
    fn input_level(
        &mut self,
        source: Channel,
        new: Level,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        for channel in [source, source.partner()] {
            let mapped = match channel_selection(channel, registers) {
                CCS_OWN_INPUT => channel == source,
                CCS_OTHER_INPUT => channel.partner() == source,
                _ => false,
            };
            if mapped && edge_selected(channel, new, registers) {
                self.capture(channel, registers, context);
            }
        }
        self.trigger_from_input(source, new, registers, context);
        self.encoder_edge(source, new, registers, context);
    }

    // `OCxCE`: a high `ETRF` drives the references low until the next update, 18.3.11.
    fn clear_references(&mut self, registers: &RegisterFile) {
        for channel in Channel::all() {
            let clear_enabled = ccmr_field(channel, &OC_CE, registers);
            let mode = output_mode(channel, registers);
            let forced = matches!(mode, OCM_FORCE_ACTIVE | OCM_FORCE_INACTIVE);
            if clear_enabled && !forced && channel_selection(channel, registers) == CCS_OUTPUT {
                let state = &mut self.channels[channel.index()];
                state.reference = false;
                state.cleared_for_updates = 1;
                state.matched_since_clear = false;
            }
        }
    }

    // The trigger input `TRGI` drawn from a channel's filtered input as `TS` selects, 18.4.3.
    fn trigger_from_input(
        &mut self,
        source: Channel,
        new: Level,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        let ts = smcr::TS.get(registers.get(Register::Smcr));
        let (trigger_level, is_edge) = match (ts, source.index()) {
            (TS_TI1_EDGES, 0) => (Level::High, true),
            (TS_TI1FP1, 0) | (TS_TI2FP2, 1) => {
                let polarised = if ccer_field(source, &CC_P, registers) {
                    !new
                } else {
                    new
                };
                (polarised, edge_selected(source, new, registers))
            }
            _ => return,
        };
        if is_edge {
            self.trigger_edge(registers, context);
        }
        self.trigger = if ts == TS_TI1_EDGES {
            Level::Low
        } else {
            trigger_level
        };
        self.gate(registers, context);
    }

    // Gated mode starts and stops the counter with the trigger's level and flags both, 18.3.14.
    fn gate(&mut self, registers: &mut RegisterFile, context: &mut DeviceContext<'_>) {
        let counting = self.should_count(registers);
        if smcr::SMS.get(registers.get(Register::Smcr)) == SMS_GATED && counting != self.counting {
            flag(registers, sr::TIF);
            self.set_counting(counting, context);
        }
    }

    // An active edge on `TRGI`: the slave mode's action and `TIF`, 18.3.14 and 18.4.5.
    fn trigger_edge(&mut self, registers: &mut RegisterFile, context: &mut DeviceContext<'_>) {
        let smcr_value = registers.get(Register::Smcr);
        // A channel on `TRC` captures the trigger's edge, under an internal trigger only, 18.4.7.
        if smcr::TS.get(smcr_value) <= TS_LAST_INTERNAL {
            for channel in Channel::all() {
                if channel_selection(channel, registers) == CCS_TRC {
                    self.capture(channel, registers, context);
                }
            }
        }
        match smcr::SMS.get(smcr_value) {
            SMS_RESET => {
                let cycle = self.counter_cycle(context.now());
                self.update(UpdateSource::Trigger, cycle, registers, context);
                self.matches_at_segment_start(Some(self.direction), registers);
                // The reset goes out on `TRGO` under `MMS` 000, 18.4.2.
                if cr2::MMS.get(registers.get(Register::Cr2)) == MMS_RESET {
                    self.trigger_pulses += 1;
                }
                self.flag_trigger(registers);
            }
            SMS_TRIGGER => {
                let cr1_value = registers.get(Register::Cr1);
                registers.set(Register::Cr1, cr1::CEN.set(cr1_value, 1));
                let counting = self.should_count(registers);
                self.set_counting(counting, context);
                self.fast_enable(registers);
                self.flag_trigger(registers);
            }
            SMS_EXTERNAL_CLOCK_1 => {
                // With both external clock modes on, the clock is `ETRF` once, 18.4.3 `ECE` note 3.
                if !smcr::ECE.is_set(registers.get(Register::Smcr)) {
                    self.external_tick(registers, context);
                }
                self.flag_trigger(registers);
            }
            _ => {}
        }
    }

    fn flag_trigger(&mut self, registers: &mut RegisterFile) {
        flag(registers, sr::TIF);
        if dier::TDE.is_set(registers.get(Register::Dier)) {
            self.dma_requests.trigger += 1;
        }
    }

    // `OCxFE`: the trigger acts like a compare match on a PWM channel, 18.3.10.
    fn fast_enable(&mut self, registers: &RegisterFile) {
        for channel in Channel::all() {
            let mode = output_mode(channel, registers);
            if ccmr_field(channel, &OC_FE, registers) && matches!(mode, OCM_PWM_1 | OCM_PWM_2) {
                self.channels[channel.index()].reference = mode == OCM_PWM_2;
            }
        }
    }

    // One edge of an external clock: a counter clock cycle, 18.3.3.
    fn external_tick(&mut self, registers: &mut RegisterFile, context: &mut DeviceContext<'_>) {
        if !self.counting {
            return;
        }
        self.external_cycles += 1;
        self.advance_counter_to(self.external_cycles, registers, context);
    }

    // The encoder interface, table 97: a valid edge counts one cycle in the direction the other input's level
    // gives.
    fn encoder_edge(
        &mut self,
        source: Channel,
        new: Level,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        let sms = smcr::SMS.get(registers.get(Register::Smcr));
        if !matches!(sms, SMS_ENCODER_1 | SMS_ENCODER_2 | SMS_ENCODER_3) {
            return;
        }
        // `DIR` follows every transition; the count follows the input the mode names, 18.3.12 and 18.4.3.
        let counted = matches!(
            (sms, source.index()),
            (SMS_ENCODER_1, 0) | (SMS_ENCODER_2, 1) | (SMS_ENCODER_3, 0 | 1)
        );
        let polarised = |channel: Channel, level: Level| {
            if ccer_field(channel, &CC_P, registers) {
                !level
            } else {
                level
            }
        };
        let edge = polarised(source, new);
        let other = source.partner();
        let other_level = polarised(other, self.inputs[other.index()].filtered);
        let rising = edge == Level::High;
        let up = match source.index() {
            0 => rising != (other_level == Level::High),
            _ => rising == (other_level == Level::High),
        };
        let direction = if up { Direction::Up } else { Direction::Down };
        if direction != self.direction {
            let cycle = self.counter_cycle(context.now());
            let count = self.count_at(cycle);
            self.direction = direction;
            self.segment_cycle = cycle;
            self.segment_count = count;
            set_direction_bit(direction, registers);
        }
        if counted {
            self.external_tick(registers, context);
        }
    }

    // A capture on `channel`: the prescaler, the latch, the flags, and the request, 18.3.5.
    fn capture(
        &mut self,
        channel: Channel,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        if !ccer_field(channel, &CC_E, registers) {
            return;
        }
        let every = 1u64 << ccmr_value_of(channel, &IC_PSC, registers);
        let state = &mut self.channels[channel.index()];
        state.prescaled_edges += 1;
        if !state.prescaled_edges.is_multiple_of(every) {
            return;
        }
        let count = self.count_at(self.counter_cycle(context.now()));
        registers.set(channel.ccr(), count);
        self.channels[channel.index()].shadow = count;
        self.flag_capture(channel, registers);
    }

    // A capture flags like a compare, with the overcapture flag when the last one was not read, 18.4.5.
    fn flag_capture(&mut self, channel: Channel, registers: &mut RegisterFile) {
        if CC_IF[channel.index()].is_set(registers.get(Register::Sr)) {
            flag(registers, CC_OF[channel.index()]);
        }
        self.flag_compare(channel, registers);
    }

    // Applies every event up to `now`, counter events and filter completions in the order of their instants.
    fn settle(&mut self, registers: &mut RegisterFile, context: &mut DeviceContext<'_>) {
        let now = context.now();
        loop {
            let counter = (!self.external)
                .then(|| self.next_counter_event(registers))
                .flatten()
                .map(|(cycle, event)| {
                    (
                        self.instant_of_counter_cycle(cycle),
                        Pending::Counter(cycle, event),
                    )
                });
            let filter = self
                .next_filter_event()
                .map(|(cycle, event)| (self.instant_of_clock_cycle(cycle), Pending::Filter(event)));
            let Some((instant, pending)) =
                counter.into_iter().chain(filter).min_by_key(|(at, _)| *at)
            else {
                break;
            };
            if instant > now {
                break;
            }
            match pending {
                Pending::Counter(cycle, CounterEvent::Boundary(source)) => {
                    self.boundary(cycle, source, registers, context);
                }
                Pending::Counter(_, CounterEvent::Match(found)) => {
                    self.compare_match(found, Some(self.direction), registers);
                }
                Pending::Filter(event) => self.filtered_edge(event, registers, context),
            }
        }
    }

    // After any change: the clock's state, the level of the interrupt, `TRGO`'s level modes, and the wake-up
    // for the next event.
    fn finish(&mut self, registers: &mut RegisterFile, context: &mut DeviceContext<'_>) {
        let counting = self.should_count(registers);
        self.set_counting(counting, context);
        self.refresh_interrupt(registers, context);
        self.refresh_trigger_output(registers);
        self.schedule(registers, context);
    }

    fn refresh_interrupt(&mut self, registers: &RegisterFile, context: &mut DeviceContext<'_>) {
        let status = registers.get(Register::Sr);
        let enables = registers.get(Register::Dier);
        let wanted = Level::from(
            INTERRUPTS
                .iter()
                .any(|(flag, enable)| flag.is_set(status) && enable.is_set(enables)),
        );
        if wanted != self.interrupt {
            self.interrupt = wanted;
            match wanted {
                Level::High => context.raise(GLOBAL_INTERRUPT),
                Level::Low => context.lower(GLOBAL_INTERRUPT),
            }
        }
    }

    fn refresh_trigger_output(&mut self, registers: &RegisterFile) {
        let mms = cr2::MMS.get(registers.get(Register::Cr2));
        self.trigger_output = match mms {
            MMS_ENABLE => Level::from(self.counting),
            MMS_RESET | MMS_UPDATE | MMS_COMPARE_PULSE => Level::Low,
            reference => {
                let index = usize::try_from(reference - MMS_FIRST_REFERENCE).expect("three bits");
                Level::from(self.channels[index].reference)
            }
        };
    }

    fn schedule(&mut self, registers: &RegisterFile, context: &mut DeviceContext<'_>) {
        let counter = (!self.external)
            .then(|| self.next_counter_event(registers))
            .flatten()
            .map(|(cycle, _)| self.instant_of_counter_cycle(cycle));
        let filter = self
            .next_filter_event()
            .map(|(cycle, _)| self.instant_of_clock_cycle(cycle));
        let next = counter.into_iter().chain(filter).min();
        // The queue has no cancel, so a wake-up already asked for at the same instant is kept, not repeated.
        if next != self.wakeup.map(|(at, _)| at) {
            self.wakeup = next.map(|at| (at, context.schedule(at)));
        }
    }

    // Starts a new segment at the current cycle with `count`, keeping the prescaler's phase.
    fn start_segment(&mut self, count: u64, context: &DeviceContext<'_>) {
        let cycle = self.counter_cycle(context.now());
        let phase = cycle.saturating_sub(self.segment_cycle) % (u128::from(self.psc) + 1);
        self.segment_cycle = cycle - phase;
        self.segment_count = count & COUNTER_MASK;
    }

    fn set_count(&mut self, count: u64, context: &DeviceContext<'_>) {
        self.start_segment(count, context);
        for channel in &mut self.channels {
            channel.last_match = None;
        }
    }

    // Restarts the segment at the current count before a shadow changes, so nothing is re-timed from the
    // segment's start into the past.
    fn rebase(&mut self, context: &DeviceContext<'_>) {
        let count = self.counter(context.now());
        self.start_segment(count, context);
    }

    fn write_cr1(
        &mut self,
        value: u64,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        let centre = cr1::CMS.get(value) != CMS_EDGE_ALIGNED;
        let encoder = matches!(
            smcr::SMS.get(registers.get(Register::Smcr)),
            SMS_ENCODER_1 | SMS_ENCODER_2 | SMS_ENCODER_3
        );
        if centre || encoder {
            // DIR is the hardware's in centre-aligned and encoder modes, 18.4.1.
            registers.set(
                Register::Cr1,
                cr1::DIR.set(value, u64::from(self.direction == Direction::Down)),
            );
        } else {
            let direction = if cr1::DIR.is_set(value) {
                Direction::Down
            } else {
                Direction::Up
            };
            if direction != self.direction {
                let count = self.counter(context.now());
                self.direction = direction;
                self.set_count(count, context);
            }
        }
        let arr = registers.get(Register::Arr) & COUNTER_MASK;
        if !cr1::ARPE.is_set(value) && arr != self.arr {
            self.rebase(context);
            self.arr = arr;
        }
    }

    fn write_smcr(
        &mut self,
        value: u64,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        let sms = smcr::SMS.get(value);
        let external = smcr::ECE.is_set(value)
            || matches!(
                sms,
                SMS_EXTERNAL_CLOCK_1 | SMS_ENCODER_1 | SMS_ENCODER_2 | SMS_ENCODER_3
            );
        if external != self.external {
            let count = self.counter(context.now());
            self.external = external;
            self.external_cycles = 0;
            self.set_count(count, context);
        }
        for channel in Channel::all().take(2) {
            self.refilter(channel, registers, context);
        }
        self.feed_etr(registers, context);
    }

    fn write_egr(
        &mut self,
        value: u64,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        if egr::UG.is_set(value) {
            let cycle = self.counter_cycle(context.now());
            self.update(UpdateSource::Software, cycle, registers, context);
            self.matches_at_segment_start(Some(self.direction), registers);
            if cr2::MMS.get(registers.get(Register::Cr2)) == MMS_RESET {
                self.trigger_pulses += 1;
            }
        }
        for channel in Channel::all() {
            if CC_G[channel.index()].is_set(value) {
                if channel_selection(channel, registers) == CCS_OUTPUT {
                    self.flag_compare(channel, registers);
                } else {
                    let count = self.counter(context.now());
                    registers.set(channel.ccr(), count);
                    self.channels[channel.index()].shadow = count;
                    self.flag_capture(channel, registers);
                }
            }
        }
        if egr::TG.is_set(value) {
            self.flag_trigger(registers);
        }
        registers.set(Register::Egr, 0);
    }

    fn write_ccmr(
        &mut self,
        register: Register,
        value: u64,
        registers: &mut RegisterFile,
        context: &DeviceContext<'_>,
    ) {
        let first = if register == Register::Ccmr1Input {
            Channel(0)
        } else {
            Channel(2)
        };
        let pair = [first, first.partner()];
        let mut held = value;
        for channel in pair {
            if ccer_field(channel, &CC_E, registers) {
                // CCxS is writable only while the channel is off, 18.4.7.
                held = CC_S[channel.index()].set(held, self.channels[channel.index()].selection);
            }
        }
        registers.set(register, held);
        let count = self.counter(context.now());
        for channel in pair {
            let selection = channel_selection(channel, registers);
            if selection == CCS_OUTPUT && !ccmr_field(channel, &OC_PE, registers) {
                self.channels[channel.index()].shadow = registers.get(channel.ccr()) & COUNTER_MASK;
            }
            let state = &mut self.channels[channel.index()];
            state.selection = selection;
            // Frozen leaves the reference where it is, 18.4.7.
            match output_mode(channel, registers) {
                OCM_FORCE_ACTIVE => state.reference = true,
                OCM_FORCE_INACTIVE => state.reference = false,
                _ => {}
            }
            self.refresh_pwm(channel, count, registers);
        }
    }

    fn write_ccr(&mut self, channel: Channel, registers: &mut RegisterFile) {
        if channel_selection(channel, registers) != CCS_OUTPUT {
            // Read-only in input mode: the last capture stands, 18.4.13.
            registers.set(channel.ccr(), self.channels[channel.index()].shadow);
            return;
        }
        if !ccmr_field(channel, &OC_PE, registers) {
            self.channels[channel.index()].shadow = registers.get(channel.ccr()) & COUNTER_MASK;
        }
    }
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum CounterEvent {
    Boundary(UpdateSource),
    Match(Match),
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
struct Match {
    channel: Channel,
    cycle: u128,
    value: u64,
}

impl CounterEvent {
    // At one cycle the boundary is applied before a match, so a match at the new count sees the new segment.
    const fn order(self) -> u8 {
        match self {
            Self::Boundary(_) => 0,
            Self::Match(..) => 1,
        }
    }
}

#[derive(Debug, Clone, Copy)]
enum FilterEvent {
    Input(usize),
    Etr,
}

#[derive(Debug, Clone, Copy)]
enum Pending {
    Counter(u128, CounterEvent),
    Filter(FilterEvent),
}

impl Device for Tim {
    type Register = Register;

    fn read(
        &mut self,
        register: Register,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) -> Option<u64> {
        self.settle(registers, context);
        let answer = match register {
            Register::Cnt => Some(self.counter(context.now())),
            Register::Ccr1 | Register::Ccr2 | Register::Ccr3 | Register::Ccr4 => {
                let channel = Channel::all().find(|channel| channel.ccr() == register)?;
                if channel_selection(channel, registers) != CCS_OUTPUT {
                    // Reading a capture clears its flag, 18.3.5.
                    let status = registers.get(Register::Sr);
                    registers.set(Register::Sr, CC_IF[channel.index()].set(status, 0));
                }
                None
            }
            Register::Dmar => {
                let target = self.burst_step(registers)?;
                Some(registers.get(target))
            }
            _ => None,
        };
        self.finish(registers, context);
        answer
    }

    fn write(
        &mut self,
        register: Register,
        value: u64,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        self.settle(registers, context);
        match register {
            Register::Cr1 => {
                let was_counting = self.counting;
                self.write_cr1(value, registers, context);
                let counting = self.should_count(registers);
                self.set_counting(counting, context);
                if counting && !was_counting {
                    self.matches_at_segment_start(Some(self.direction), registers);
                }
            }
            Register::Smcr => self.write_smcr(value, registers, context),
            Register::Egr => self.write_egr(value, registers, context),
            Register::Ccmr1Input | Register::Ccmr1Output => {
                self.write_ccmr(Register::Ccmr1Input, value, registers, context);
            }
            Register::Ccmr2Input | Register::Ccmr2Output => {
                self.write_ccmr(Register::Ccmr2Input, value, registers, context);
            }
            Register::Ccer => {
                for channel in Channel::all() {
                    if !ccer_field(channel, &CC_E, registers) {
                        // The capture prescaler resets while the channel is off, 18.4.7.
                        self.channels[channel.index()].prescaled_edges = 0;
                    }
                    self.refresh_pwm(channel, self.counter(context.now()), registers);
                }
            }
            Register::Cnt => {
                self.set_count(value, context);
                self.matches_at_segment_start(Some(self.direction), registers);
            }
            Register::Arr => {
                // Without preload the new auto-reload is live from here on, never from the segment's start.
                let arr = value & COUNTER_MASK;
                if !cr1::ARPE.is_set(registers.get(Register::Cr1)) && arr != self.arr {
                    self.rebase(context);
                    self.arr = arr;
                }
            }
            Register::Ccr1 | Register::Ccr2 | Register::Ccr3 | Register::Ccr4 => {
                if let Some(channel) = Channel::all().find(|channel| channel.ccr() == register) {
                    self.rebase(context);
                    self.write_ccr(channel, registers);
                    self.refresh_pwm(channel, self.counter(context.now()), registers);
                }
            }
            Register::Dmar => {
                if let Some(target) = self.burst_step(registers) {
                    registers.write_over_bus(target, value);
                    self.write(target, value, registers, context);
                    return;
                }
            }
            _ => {}
        }
        self.finish(registers, context);
    }

    fn on_event(
        &mut self,
        event: EventId,
        registers: &mut RegisterFile,
        context: &mut DeviceContext<'_>,
    ) {
        if self.wakeup.map(|(_, id)| id) != Some(event) {
            return;
        }
        self.settle(registers, context);
        self.finish(registers, context);
    }
}

impl Tim {
    // The register the next `DMAR` access reaches, walking `DBL + 1` registers from `DBA`, 18.4.18.
    fn burst_step(&mut self, registers: &RegisterFile) -> Option<Register> {
        let dcr_value = registers.get(Register::Dcr);
        let base = dcr::DBA.get(dcr_value);
        let length = dcr::DBL.get(dcr_value);
        let index = base + self.burst_index;
        self.burst_index = (self.burst_index + 1) % (length + 1);
        BURST_REGISTERS
            .get(usize::try_from(index).expect("ten bits"))
            .copied()
            .flatten()
    }
}

// The filter row of `ICxF` or `ETF`: how many `CK_INT` cycles a transition needs to pass, 18.4.3 and 18.4.7.
fn filter_delay(row: u64, registers: &RegisterFile) -> u128 {
    let (sampling, samples) = FILTERS[usize::try_from(row).expect("four bits")];
    let dts_division = 1u128 << cr1::CKD.get(registers.get(Register::Cr1));
    let period = match sampling {
        Sampling::Internal => 1,
        Sampling::Dts(divisor) => dts_division * divisor,
    };
    period * samples
}

fn start_filter(input: &mut Input, level: Level, clock: u128, delay: u128) {
    if level == input.filtered {
        input.pending = None;
    } else {
        input.pending = Some((clock + delay, level));
    }
}

// Whether a filtered transition to `new` is an active edge for `channel` under `CCxP` and `CCxNP`, 18.4.9.
fn edge_selected(channel: Channel, new: Level, registers: &RegisterFile) -> bool {
    let falling = ccer_field(channel, &CC_P, registers);
    let both = ccer_field(channel, &CC_NP, registers);
    both || (new == Level::High) != falling
}

fn ccmr_value_of(
    channel: Channel,
    fields: &[&FieldSpec; CHANNELS],
    registers: &RegisterFile,
) -> u64 {
    fields[channel.index()].get(registers.get(channel.ccmr()))
}

fn ccmr_field(channel: Channel, fields: &[&FieldSpec; CHANNELS], registers: &RegisterFile) -> bool {
    fields[channel.index()].is_set(registers.get(channel.ccmr()))
}

fn ccer_field(channel: Channel, fields: &[&FieldSpec; CHANNELS], registers: &RegisterFile) -> bool {
    fields[channel.index()].is_set(registers.get(Register::Ccer))
}

fn flag(registers: &mut RegisterFile, field: &FieldSpec) {
    let status = registers.get(Register::Sr);
    registers.set(Register::Sr, field.set(status, 1));
}

fn channel_selection(channel: Channel, registers: &RegisterFile) -> u64 {
    ccmr_value_of(channel, &CC_S, registers)
}

fn output_mode(channel: Channel, registers: &RegisterFile) -> u64 {
    ccmr_value_of(channel, &OC_M, registers)
}

fn set_direction_bit(direction: Direction, registers: &mut RegisterFile) {
    let cr1_value = registers.get(Register::Cr1);
    registers.set(
        Register::Cr1,
        cr1::DIR.set(cr1_value, u64::from(direction == Direction::Down)),
    );
}